CVE-2023-45229: Tianocore EDK2 Information Disclosure Flaw

CVE-2023-45229 Overview

CVE-2023-45229 is an out-of-bounds read vulnerability in the Network Package of TianoCore EDK2, the reference implementation of the Unified Extensible Firmware Interface (UEFI). The flaw resides in the DHCPv6 client logic and triggers when the firmware parses the IA_NA (Identity Association for Non-temporary Addresses) or IA_TA (Identity Association for Temporary Addresses) option inside a malicious DHCPv6 Advertise message. An attacker on the same link-local network can craft a response during PXE network boot to read memory outside the intended buffer. The issue is part of the PixieFail cluster of UEFI network stack vulnerabilities disclosed in January 2024.

Critical Impact
Adjacent-network attackers can leak firmware memory during PXE boot, breaking confidentiality of UEFI runtime data and potentially exposing material useful for follow-on attacks.

Affected Products

TianoCore EDK2 Network Package (NetworkPkg) DHCPv6 client
Downstream UEFI firmware distributions built on EDK2
NetApp products bundling EDK2 components (per NetApp advisory)

Discovery Timeline

2024-01-16 - CVE CVE-2023-45229 published to the National Vulnerability Database
2025-06 - Debian LTS announcement issued for affected EDK2 packages
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2023-45229

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in the DHCPv6 option parser inside EDK2's NetworkPkg. During PXE boot over IPv6, the UEFI firmware acts as a DHCPv6 client and consumes Advertise messages from servers on the local link. The parser walks the IA_NA and IA_TA options without sufficiently validating the declared option length against the remaining packet buffer. When a malformed length is supplied, the parser reads past the end of the received packet buffer. The leaked bytes can include adjacent heap data managed by the UEFI memory allocator, which may contain pointers, configuration data, or other firmware state.

Root Cause

The root cause is missing or inadequate bounds validation on attacker-controlled length fields in the DHCPv6 option processing routines. The code trusts the encoded option length when iterating through nested option structures inside IA_NA and IA_TA containers. No check confirms that the option fits within the remaining packet payload before dereferencing.

Attack Vector

Exploitation requires adjacent network access. An attacker must be able to send DHCPv6 traffic on the same broadcast domain as a system performing PXE network boot. The attacker responds to a victim's DHCPv6 Solicit message with an Advertise packet carrying a crafted IA_NA or IA_TA option whose internal length fields exceed the actual payload. No authentication or user interaction is required, but the victim must be in the network boot phase.

No verified exploit code is reproduced here. A public proof of concept for the PixieFail set is available at the Packet Storm PoC listing, and technical details are documented in the GitHub Security Advisory GHSA-hc6x-cw6p-gj7h.

Detection Methods for CVE-2023-45229

Indicators of Compromise

Unexpected DHCPv6 Advertise traffic originating from non-authorized servers on provisioning VLANs.
DHCPv6 packets containing IA_NA (option code 3) or IA_TA (option code 4) with internal option-length fields that exceed the UDP payload size.
PXE boot failures, firmware hangs, or unexpected reboots on systems during IPv6 network boot.

Detection Strategies

Inspect DHCPv6 traffic on PXE-enabled segments and alert on malformed option length fields inside IA_NA/IA_TA containers.
Restrict and monitor which MAC addresses are authorized to send DHCPv6 server responses on provisioning networks.
Correlate firmware update telemetry with vendor advisories from NetApp and the CERT Vulnerability Note VU#132380 to confirm patched baselines.

Monitoring Recommendations

Enable DHCP snooping and IPv6 RA Guard on access switches to block unauthorized DHCPv6 servers.
Capture and retain packet traces from network boot subnets for post-incident analysis of option-length anomalies.
Track firmware version inventory across hardware fleets and flag systems still running pre-patch EDK2 builds.

How to Mitigate CVE-2023-45229

Immediate Actions Required

Apply firmware updates from hardware vendors that incorporate the patched EDK2 NetworkPkg referenced in GHSA-hc6x-cw6p-gj7h.
Disable IPv6 in PXE boot configurations on systems that only require IPv4 provisioning.
Segment provisioning networks so that only trusted DHCP and DHCPv6 servers are reachable by hosts during boot.

Patch Information

The TianoCore project published fixes in the EDK2 source tree alongside the GitHub Security Advisory. Downstream distributors have issued matching updates, including the Debian LTS Announcement, the NetApp Security Advisory NTAP-20240307-0011, and the Openwall OSS Security Update. Coordinate firmware updates with each hardware vendor since EDK2 ships as a base for OEM UEFI builds.

Workarounds

Disable network boot (PXE) entirely in UEFI setup when not required for operations.
Where PXE is required, prefer IPv4-only PXE configurations until firmware is patched.
Enforce strict layer-2 controls on provisioning segments to prevent rogue DHCPv6 Advertise traffic from reaching unpatched hosts.

bash

# Configuration example: disable DHCPv6 on a Linux PXE provisioning host
# and restrict DHCPv6 server replies to known MAC addresses on the switch.
sysctl -w net.ipv6.conf.all.accept_ra=0
sysctl -w net.ipv6.conf.default.accept_ra=0
# Example switch ACL pseudo-config:
# permit udp host <trusted-dhcpv6-server-mac> eq 547 any
# deny   udp any eq 547 any